Exploit for Improper Neutralization of Special Elements Used in a Template Engine in Adobe Commerce

abraxaslabs.tech · github.com/abraxas ·&...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect via the redirect parameter in message.php. An attacker can redirect users to arbitrary external sites by crafting malicious links containing base64-encoded URLs, potentially facilitating phishing attacks. Remediation There...

CVE-2026-100523

Cotonti through 1.0.0 contains an open redirect vulnerability in message.php that base64-decodes the redirect parameter without domain validation. Unauthenticated attackers can craft malicious links with encoded external URLs to redirect users to arbitrary sites via meta refresh tags for phishing...

CVE-2026-100523

Cotonti versions through 1.0.0 are vulnerable to an open redirect in the message.php component. The root cause is that the application base64-decodes the redirect parameter without performing any domain validation . Unauthenticated attackers can exploit this by crafting malicious links with encod...

EUVD-2026-87378

Cotonti through 1.0.0 contains an open redirect vulnerability in message.php that base64-decodes the redirect parameter without domain validation. Unauthenticated attackers can craft malicious links with encoded external URLs to redirect users to arbitrary sites via meta refresh tags for phishing...

CVE-2026-100523 Cotonti through 1.0.0 Open Redirect via message.php redirect parameter

Cotonti through 1.0.0 contains an open redirect vulnerability in message.php that base64-decodes the redirect parameter without domain validation. Unauthenticated attackers can craft malicious links with encoded external URLs to redirect users to arbitrary sites via meta refresh tags for phishing...

CVE-2026-100523 Cotonti through 1.0.0 Open Redirect via message.php redirect parameter

Cotonti through 1.0.0 contains an open redirect vulnerability in message.php that base64-decodes the redirect parameter without domain validation. Unauthenticated attackers can craft malicious links with encoded external URLs to redirect users to arbitrary sites via meta refresh tags for phishing...

CVE-2026-100523 Cotonti through 1.0.0 Open Redirect via message.php redirect parameter

Cotonti through 1.0.0 contains an open redirect vulnerability in message.php that base64-decodes the redirect parameter without domain validation. Unauthenticated attackers can craft malicious links with encoded external URLs to redirect users to arbitrary sites via meta refresh tags for phishing...

CVE-2026-100523: URL Redirection to Untrusted Site

Cotonti through 1.0.0 contains an open redirect vulnerability in message.php that base64-decodes the redirect parameter without domain validation. Unauthenticated attackers can craft malicious links with encoded external URLs to redirect users to arbitrary sites via meta refresh tags for phishing...

PT-2026-99149

Name of the Vulnerable Software and Affected Versions Cotonti versions prior to 1.0.1 Description An open redirect issue exists in the 'message.php' endpoint. The application base64-decodes the redirect parameter without performing proper domain validation. This allows unauthenticated attackers t...

busybox: busybox: httpd silently fails open when IP deny rules contain invalid CIDR prefix lengths

BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients...

CVE-2026-100304 TDuck survey form 6.0 Information Disclosure via Fail-Open Form Ownership Check

TDuck survey form 6.0 contains an information disclosure vulnerability in FormAuthUtils.hasPermission that fails open when a form does not exist, allowing authenticated users to access deleted form submissions. Attackers can read orphaned submission data including personal information by providin...

CVE-2026-47883

A flaw was found in the UrlHandlerFilter component of Spring Framework. When this filter is configured with overly broad patterns, it can be vulnerable to an open redirect. A remote attacker could exploit this by crafting a malicious URL, which, when clicked by a user, redirects them to an...

CVE-2026-97865

A security flaw has been discovered in Open-Web-Analytics up to 1.8.1. Affected is the function Event::loadFromArray of the file queue.php of the component Remote Event Queue Endpoint. Performing a manipulation results in deserialization. The attack can be initiated remotely. Upgrading to version...

CVE-2026-97865 Open-Web-Analytics Remote Event Queue Endpoint queue.php loadFromArray deserialization

A security flaw has been discovered in Open-Web-Analytics up to 1.8.1. Affected is the function Event::loadFromArray of the file queue.php of the component Remote Event Queue Endpoint. Performing a manipulation results in deserialization. The attack can be initiated remotely. Upgrading to version...

EUVD-2026-87090

A security flaw has been discovered in Open-Web-Analytics up to 1.8.1. Affected is the function Event::loadFromArray of the file queue.php of the component Remote Event Queue Endpoint. Performing a manipulation results in deserialization. The attack can be initiated remotely. Upgrading to version...

CVE-2026-97865 Open-Web-Analytics Remote Event Queue Endpoint queue.php loadFromArray deserialization

A security flaw has been discovered in Open-Web-Analytics up to 1.8.1. Affected is the function Event::loadFromArray of the file queue.php of the component Remote Event Queue Endpoint. Performing a manipulation results in deserialization. The attack can be initiated remotely. Upgrading to version...

CVE-2026-97865

A security flaw in Open-Web-Analytics (up to version 1.8.1) allows for remote deserialization . The vulnerability exists within the Event::loadFromArray function in the queue.php file of the Remote Event Queue Endpoint component. An attacker can initiate this attack remotely by performing manipul...

CVE-2026-97865 Open-Web-Analytics Remote Event Queue Endpoint queue.php loadFromArray deserialization

A security flaw has been discovered in Open-Web-Analytics up to 1.8.1. Affected is the function Event::loadFromArray of the file queue.php of the component Remote Event Queue Endpoint. Performing a manipulation results in deserialization. The attack can be initiated remotely. Upgrading to version...

AZL-104645 CVE-2026-97612 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net: mpls: clear innerprotocol when the last label is popped skbmplspush records the pre-encapsulation network header once, gated on !skb-innerprotocol. skbmplspop never clears that record, so it outlives the encapsulation it...